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Cryptic clues 
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Deas 9 humm is a process used to 
scramble a message, so that only 
the sender and recipient know what 
it contains. Only the recipient knows 
the secret method for decrypting the 
message, so that when it is received 
it can be restored to its original form. 

Some simple encryption schemes 
are based on codes. Strictly speaking, 
coding refers to a method where every 
possible symbol in the message is sub- 
stituted in straightforward fashion by 
some other symbol — the same one 
every time. This simple method is 
easy to crack, and is often used for 
convenience when secrecy is not 
required. The ASCII codes simply 
define numbers that can be substitut- 
ed for other characters. 

There is one encryption scheme 


which is 100% foolproof and uncrack- 
able: the one-time pad. To use it you 
must have some randomly created 
data to hand. The random number 
generators on computers produce only 
pseudo-random numbers, meaning 
they rely on some numerical method 
that produces each number in the 
sequence. With truly random num- 
bers, no amount of analysis of the pre- 
ceding sequence will let you predict 
the next number. The only way to get 
true randomness is to measure ran- 
dom physical phenomena in some 
way. For example, a number sequence 
could be based on measured molec- 
ular movements in a gas. 

Armed with this random data, you 
make one copy of it only and give it 
to the recipient. The encryption 


Fig 1: Program to perform encryption and decryption using the 


‘one-time pad’ method. 


randdata$ = “ZA\HEF #GRS*QKM9FQUS3SIPW_MTUBZ%&ODFABVLOERWN- 


WLSA7 SFG” 


message$ = “MEET AT THE LAMB AND FLAG AT 20:00, 25/11/93” 


PRINT “Plain text: 


“; message$ 


REM Method for encrypting message... 


gobbledy$ = “” : 
FOR i = 1 TO LEN(message$) 


chnum = ASC(MID$(message$, i, 1)) - 32 
randnum = ASC(MID$(randdata$, i, 1)) - 32 
gobbledy$ = gobbledy$ + CHR$(32 + (chnum + randnum) MOD 


64) 
NEXT i 
PRINT “Encrypted: 


“; gobbledy$ 


REM Method for decrypting message... 


decrypt$ = “” 
FOR i = 1 TO LEN(gobbledy$) 


chnum = ASC(MID$(gobbledy$, i, 1)) - 32 
randnum = ASC(MID$(randdata$, i, 1)) - 32 
decrypt$ = decrypt$ + CHR$(32 + (chnum + (64 - randnum) ) 


MOD 64) 
NEXT i 


PRINT “Decrypted: “; 
STOP 


decrypt$ 
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method is simple but tedious to per- 
form by hand: each symbol in the mes- 
sage is combined with its matching 
one in the random _ sequence. 
Decryption simply uses the same list 
of random symbols. It processes the 
encrypted message one symbol at a 
time and extracts the matching ran- 
dom symbol to restore the plain text. 

There are several ways of combin- 
ing one symbol with another in such 
a way that it can be extracted subse- 
quently. Modular arithmetic is as good 
a method as any. Fig 1 gives a QBasic 
program that shows how this can be 
made to work in practice, with its out- 
put given in Fig 2. 

We will need to know more about 
modular arithmetic later, so a brief 
digression is in order. Modular arith- 
metic is like a generalised ‘clock’ arith- 
metic, where if you advance the clock 
hands five hours from 10.00, it does 
not become 15.00 but 3.00. Clock arith- 
metic is arithmetic modulo 12 (or mod- 
ulo 60 when you are working with 
the minutes hand), but it is possible 
to do arithmetic modulo anything. For 
example, 26 + 9 modulo 27 is 8; 5 x 
5 modulo 19 is 6; 9x 3 modulo 7 is 6 
(9 x 3 is 27 and 6 is the remainder 
when 27 is divided by 7). 

Most complications in the one-time 
pad program are caused by the vagaries 
of character representations in a com- 
puter. The program here only deals 
with uppercase and a few other sym- 
bols: anything with ASCII codes from 
32 to 95. For calculation purposes it 
reduces all characters to numbers 
between 0 and 63. Encryption takes a 
message character number and adds 
it to arandom character number, mod- 
ulo 64. Given the character A and ran- 
dom character Q, these are reduced to 
numbers 33 (that is ASCII code 65 - 
32) and 49 (81 - 32). The sum of 33 
and 49 is 82, which is 18 modulo 64 
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Fig 2: Sample output showing one-time pad encryption. 


Plain text: MEET ME AT THE LAMB AND FLAG AT 20:00, 25/11/93 
Encrypted: !#A..etc.. 
Decrypted: MEET ME AT THE LAMB AND FLAG AT 20:00, 25/11/93 


(18 = 82 - 64). When converted back 
to a character with code between 32 
and 95, this becomes the character 2 
(that is, with ASCII code, 50 = 18 + 32). 

Encryption of A using Q amounted 
to calculating the ‘value’ of A + Qmod- 
ulo 64. Decryption amounts to taking 
the encrypted value, let’s call itE, and 
subtracting Q from it modulo 64. This 
is the calculation E - Q modulo 64, 
which reverses the encryption and 
restores the original character, A. 

For the method to be 100% uncrack- 
able the random characters must never 
be reused on another message. Of 
course, in classic spy stories, books 
are often used as one-time pads along 
with some convention that a particu- 
lar page is used as the random text for 
a particular day. This isn’t truly ran- 
dom data as the book text will have a 
language bias, and it could be made 
insecure by there being more than two 
copies of the book around. 

When experimenting with this 
method on a computer, you could use 
a word processor file as the source of 
random data, or even executable pro- 
gram files if you remove all the zeros, 
spaces and other characters that appear 
too often. The random data cannot be 
transmitted to the recipient down the 
same channel as the messages, other- 
wise it could be intercepted. 

One-time pads are not used much 
in computer communications, or at 
least no-one talks about it if they are 
using them. Generation of truly ran- 
dom data requires special hardware, 
which could be produced quite cheap- 
ly. Itis inconvenient to hand over the 
random data to the recipient by some 
means independent of the normal 
communications channel. And when 
communications are flying between 
several parties, things get confusing 
when each pair of communicators 
needs its own paired sets of random 
data. Remember, data can only be used 
once so there needs to be a lot of it. 

There are some secure methods 
which do not suffer from the opera- 
tional problems of one-time pads. One 
is the RSA Cryptosystem (named after 
the initials of its inventors). It isn’t 
100% secure but it is estimated that 
it would take billions of years of analy- 
sis, at computer speed, before it could 
be cracked. 

The RSA method is a public key 


cryptosystem: the method for encrypt- 
ing messages is public knowledge. 
Anyone who wants to receive a mes- 
sage gives out a pair of specially pre- 
pared numbers which can be used in 
a standard fashion to encrypt all the 
messages sent to the receiver. The 
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numbers are chosen in conjunction 
with another one that the receiver 
keeps private and uses to decrypt the 
message. No-one can reverse the 
process without the private number. 

This is analogous to a messaging 
service which uses self-locking pad- 
locks on boxes. Anyone who wants to 
receive a message designs a padlock 
and gives out identical copies to any- 
one that may be interested, but keeps 
the key. Anyone can ‘encrypt’ a mes- 
sage by putting it in a box and shut- 
ting it with the appropriate padlock, 


Fig 3: Program to generate the first 16,000 prime numbers and store 


them in a file. 


DECLARE SUB calcprimes (nreq AS LONG) 
DECLARE SUB saveprimes (nprimes AS LONG, filename AS STRING) 


DIM primes(16000) AS LONG 
CALL calcprimes (16000) 
CALL saveprimes (16000, 
STOP 


SUB calcprimes (nreq AS LONG) 


“prs16000.dat”) 


REM Calculates the first nreq primes, printing as it goes and 


saves them 
REM in the array primes() 
SHARED primes() AS LONG 


DIM n AS LONG, nprimes AS LONG, prx AS LONG, q AS LONG, r AS 


LONG 

DIM unprime AS INTEGER 
PRINT : PRINT 

PRINT “Printing first “; 


nreq; “ primes” 


PRINT NEKKEKEEKEEKEKEEEEEKEEEKKEEEKEEKEEEEKREKEKEEEREN 


primes(1) = 2: 
FOR nprimes = 2 TO nreq 
REM n is prime... 


primes(nprimes) = n: PRINT n; 


unprime = -1 


n = 3: PRINT primes(1); 


DO ‘Keep adding 2 to n until we get next prime 


n=n + 2: 


FOR prx = 2 TO nprimes ‘For each odd prime we already 


have.. 


q =n \ primes(prx): r = n MOD primes (prx) 


IF rx = 0 THEN EXIT FOR 
IF q <= primes(prx) THEN 
unprime = 0 
EXIT FOR 
END IF 
NEXT prx 
LOOP WHILE unprime 
NEXT nprimes 
END SUB 


SUB saveprimes (nprimes AS LONG, 


DIM i AS LONG 
SHARED primes() AS LONG 


filename AS STRING) 


OPEN filename FOR RANDOM AS #1 LEN = 4 


PUT #1, 1, nprimes 

FOR i = 1 TO nprimes 

PuT #1, i+ 1, primes(i) 
NEXT i 

CLOSE #1 

END SUB 
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Fig 4: Program to generate the public and private keys for the RSA 


Cryptosystem 


DECLARE FUNCTION multinv# (x AS DOUBLE, m AS DOUBLE) 


CLEAR , , 20000 ‘Some heavy recursion! 
DIM p AS DOUBLE, q AS DOUBLE, k AS DOUBLE, g AS DOUBLE 


DIM n AS DOUBLE, mm AS DOUBLE 


DIM nprimes AS LONG, pp AS LONG, aq AS LONG, kk AS LONG 


OPEN “prsi16000.dat” FOR RANDOM AS #1 LEN = 4 


GET #1, 1, nprimes 
RANDOMIZE TIMER 
DO 


GET #1, INT(RND * nprimes) + 2, pp: P 
GET #1, INT(RND * nprimes) + 2, qq: q 
GET #1, INT(RND * nprimes) + 2, kk: k 


IF p > k THEN SWAP p, k 
n=p*q 


Fa 8 


LOOP UNTIL n >= 64 * 5 AND n < 256 “ 5 


m= (p - 1) * (q - 1) 
g = multinv#(k, mm) 
PRINT “Primes (p,q) are: “; p; 


q 


PRINT “Max size of plain text number for encryption (n=p*q): 


big! n 
PRINT “Public key (g): “; g 
PRINT “Private key (k): “; k 
STOP 


FUNCTION multinv# (x AS DOUBLE, m AS DOUBLE) 

REM calculates multiplicative inverse of x modulo m 
REM ie finds y, so that x * y = 1 mod m 

DIM nxs AS DOUBLE, excess AS DOUBLE 


IF x = 1 THEN 
multinv# = 1 
EXIT FUNCTION 

END IF 


nxs = INT(m / x) + 1 ‘nxs is min val so that nxs * x > m 
excess = nxs * x - m ‘excess is amount by which it is 


greater than m 


y# = INT((multinv#(excess, x) * m +1) / x) 


multinv# = y# 
END FUNCTION 


but only the chap who gave out the 
padlocks has the key, so only he can 
open the lock and read the message. 

The RSA method uses some well 
known results from number theory, 
concerning prime numbers and mod- 
ular arithmetic. Most numbers are not 
prime, but there are still plenty of 
primes around of all sizes. For maxi- 
mum security the RSA method needs 
to work with primes of 150 digits or 
so. Enough 150-digit primes exist for 
them to be found quickly. 

One of the public key numbers in 
the method comes from multiplying 
two large primes of around 150 digits 
apiece, producing an even larger num- 
ber of around 300 digits. It is critical 
that no-one will ever discover the num- 
bers that generated the big number, 
although it can be divided by the two 


150-digit primes that generated it. 

There are well known methods for 
determining which numbers divide 
a non-prime or composite number. A 
simple program loop which tries every 
number from two up to the number 
itself will eventually discover all of 
the number’s ‘factors’. This would 
not be an efficient factorisation 
method but even the best methods 
can only work in reasonable time for 
smallish numbers, say up to around 
ten digits. There is no method which 
can produce a response in less than 
several billion years if it has to work 
on a very large number — not in this 
universe anyway. 

The RSA method begs the ques- 
tion of how we generate the 150-digit 
primes in the first place. There is a 
method that takes a number at random 


PERSONAL COMPUTER WORLD NOVEMBER 1993 


(that part is easy enough) and tests it 
against a few hundred others chosen 
virtually at random. If a test fails for 
any of the numbers the original num- 
ber is not prime, but as each test is 
passed the confidence in its primeness 
grows. The chance of the number 
being composite is halved after each 
pass, so after passing 200 tests there 
is a 1 in 24200 chance that the num- 
ber is not prime, which is such a low 
probability that it can be discounted. 

If the number fails one of the tests, 
a new 150-digit number should be 
selected at random, and so on until a 
number is found that passes. For 150- 

digit numbers about one in 500 is 
prime, so it should hardly ever take 
more than a thousand attempts to find 
a prime by casting around at random 
and this should not take too long over- 
all at computer speed. 

Here we will show the RSA method 
on smaller primes. It is not secure 
enough for real applications but is 
sufficient to show the method in 
action. The problem is that most pro- 
gramming languages can only per- 
form arithmetic on numbers up to 
about ten digits: they need special 
procedures to handle larger numbers. 
(Some versions of Lisp have infinite 
precision arithmetic.) We will con- 
fine ourselves to five or six-digit 
primes, which will result in ten or 
twelve-digit numbers that QBasic can 
handle. Its double-precision floating 
point representation carries 15 to 16 
digits of precision. 

The routine in Fig 3 can be used to 
generate the first 16,000 primes using 
a ‘sieve’ method, and store them in a 
file. This covers all the primes of five 
or less digits and a few six-digit primes 
as well. We will call on these primes 
in the RSA method below. 

The start point for the RSA method 
involves choosing two primes, say P 
and Q, and multiplying them togeth- 
er to produce N. N is destined to 
become public knowledge with P and 
Q kept private, but as we have already 
said, if P and Q are big enough N will 
be so large that no-one will ever get 
from N to P and Q. As an intermedi- 
ate step the number R = (P - 1) x (Q- 
1) is calculated, and a number K has 
to be determined which will be the pri- 
vate key. K can be any number with 
no common factor with R. It doesn’t 
have to be prime but it is probably 
easiest just to take a prime number 
greater than P or Q and less than R. 

The next step is to. calculate a num- 
ber G, which will be the other half of 
the public key. G is determined by 
solving the equation: 
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Fig 5: Sample output from the RSA key generation program 


Primes (p,q) are: 161233 162221 
Max size of plain text number for encryption (n=p*q): 


26155378493 
Public key (g): 16162890089 
Private key (k): 168089 


K x G = 1 modulo R 


Gis the multiplicative inverse of K 
modulo R. An obvious way to find G 
is to try every possible value, from 0 
to R - 1. Unfortunately, as R is very 
large, even with only five-digit primes 
this would take an enormous amount 
of time. Fortunately there is an easi- 
er method that homes in on the solu- 
tion, if there is one, very quickly. (See 
the multinv function in Fig 4). 

G and N are made public, so any- 
one can use them to encrypt a message. 
The receiver need only retain the num- 
ber K, which will be used in con- 
junction with the publicly known N 
to decrypt messages. Fig 4 shows a 
program that can generate the public 
and private keys, K, G and N, with a 
sample of its output in Fig 5. Notice 
it uses the QBasic random number 
generator to choose the primes it will 
work with. This could be a possible 
source of insecurity as QBasic only 
produces pseudo-random numbers. 

To perform encryption, the sender 
must organise the message into blocks 
of digits using some straightforward 
mechanism like their ASCII charac- 
ter codes. Each block must represent 
a number less than N, which is one of 
the numbers in the public key. With 
N calculated from five or six-digit 
primes it will only be ten or twelve dig- 
its long, so the message should be bro- 
ken up into blocks of nine or ten-digit 
numbers, all comfortably less than N. 

To encrypt one block of digits, say 
those representing the number M, the 
calculation M * G modulo N is per- 
formed. Do the same for all blocks and 
that’s all there is to it. A naive imple- 
mentation of the modular M “ G calcu- 
lation would simply multiply M by 
itself G times and then take the mod- 
ulus of the result. But G is typically a 
large number so this would take far too 
long: the modexp function in Fig 6 is 
much quicker. Once all blocks of dig- 
its have been processed, the resulting 
message can be safely sent to the recip- 
ient, who decrypts the message using 
the secret key number K and the pub- 
lic N. For an encrypted block of dig- 
its X, the decryption is done by the cal- 
culation X “ K modulo N. The modexp 
function can do this. 

With all blocks of digits decrypted, 


the message can be put back togeth- 
er by reversing the original pre-encryp- 
tion organisation, typically by inter- 
preting the numbers as ASCII codes 
and converting back to characters. Fig 
6 shows the complete program for 
encrypting and decrypting a message, 
with a sample run shown in Fig 7. 
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characters at a time into a number 
block for encryption. This is simple 
but not ideal: in a long message a 
repeated five-letter group is possible 
and would have the same encryption. 
It would be better for each number 
block to be derived from information 
spread right across the message. 
With traditional paper communi- 
cations the problems are all handled 
by formal written signatures on doc- 
uments, but for electronic communi- 
cations an electronic signature is need- 
ed. One of the interesting properties 
of the RSA method is that decrypting 
an encrypted message produces the 
same result as encrypting a decrypt- 
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This method combines five ed message. This is a property known 


Fig 6: Program to do RSA encryption/decryption, with predefined 
keys 


DECLARE FUNCTION num2str$ (num AS DOUBLE, range AS INTEGER) 
DECLARE FUNCTION str2num# (str AS STRING, range AS INTEGER) 
DECLARE FUNCTION modmult# (x AS DOUBLE, y AS DOUBLE, m AS 
DOUBLE) 

DECLARE FUNCTION modexp# (x AS DOUBLE, n AS DOUBLE, m AS 
DOUBLE) 

CLEAR , , 20000 ‘Some heavy recursion! 

DIM n AS DOUBLE, k AS DOUBLE, g AS DOUBLE 

‘p=89317,q=90001 so p*q=n=8038619317 

n = 8038619317# ‘Max value of an encrypted block 

g = 1931938747# ‘Public key 

Kk = 92083# ‘Private key 


‘Alternative set... 
‘p=161233,q=162221, so p*q=n=.. 
‘n = 26155378493# 

‘g = 16162890089# 

‘k = 168089# 


message$ = “DEAR CONTROL, I COUNTED 37 SHIPS IN PORT TODAY 
- AGENT X” 
PRINT “Plain text: “; message$ 
REM Encryption of message 
REM First pad it to a multiple of 5 characters 
message$ = message$ + LEFTS$(“ “, 5 - LEN(message$) MOD 
5) 
encrypt$ = “” 
FOR i = 1 TO LEN(message$) STEP 5 

encrypt$ = encrypt$ + num2str$(modexp# (str2num# (MID$ (mes- 
sage$, i, 5), 64), g, n), 256) 
NEXT i 
PRINT “Encryption: “; encrypt$ 
REM Decryption of message... 
decrypt$ = “” 
FOR i = 1 TO LEN(encrypt$) STEP 5 

decrypt$ = decrypts + 
num2str$ (modexp#(str2num#(MID$(encrypt$, i, 5), 256), k, 
n), 64) ; 
NEXT i 
PRINT “Decryption: “; decrypt$ 
STOP 


FUNCTION modexp# (x AS DOUBLE, n AS DOUBLE, m AS DOUBLE) 


REM Calculates x*n mod m for very large x,n and m 
| 939 


ae HANDS ON - LOW LEVEL 


REM Does binary chop on n. Assumes 0<=x<m, 0<=n 
DIM xhalfnm AS DOUBLE, halfn AS DOUBLE, nms AS DOUBLE 
IF n = 0 THEN 
modexp# = 1 
ELSEIF n = 1 THEN 
modexp# = x 
ELSE 
halfn = INT(n / 2) 
‘Calculate int (modexp#(x,halfn,m) * modexp#(x,halfn,m) * 
modexp# (x,n-2*halfn,m) /m) 
‘but do it more efficiently and watch out for overflow 
xhalfnm = modexp#(x, halfn, m) 
modexp# = modmult#(modmult#(xhalfnm, xhalfnm, m), mod- 
exp#(x, n - 2 * halfn, m), m) 
END IF 
END FUNCTION 


FUNCTION modmult# (x AS DOUBLE, y AS DOUBLE, m AS DOUBLE) 
‘Calculate x * y mod m. x, y, m may all have up to 10 digits 
‘Assume 0<=x<m, 0<=y<m 

DIM yl AS DOUBLE, y2 AS DOUBLE, xyl AS DOUBLE, xy2 AS DOU- 
BLE, ans AS DOUBLE 

yl = INT(y / 100000) 

y2 = y - yl * 100000 

xyl = x * yl 

xy2 = x * y2 

‘Actual number is xy1*100000 + xy2 

FOR i = 1 TO 5 ‘One iter for each zero in 100000 

xyl = (xyl - INT(xyl / m) * m) * 10 

NEXT i 

xy2 = xy2 - INT(xy2 / m) *m 

ans = xyl + xy2 

modmult# = ans - INT(ans / m) * m 

END FUNCTION 


FUNCTION num2str$ (num AS DOUBLE, range AS INTEGER) 
REM Convert number, into five char string. 
REM range is 64/256 see str2num 
ans$ = Wa 
FOR i. = '1 TO 5 
ans$ = CHR$(num - range * INT(num / range) - 32 * (range = 
64)) + ans$ 
num = INT(num / range) 
NEXT i 
num2str$ = ans$ 
END FUNCTION 


> 


FUNCTION str2num# (str AS STRING, range AS INTEGER) 
REM Convert 5 character string into a number 
REM range is 64 or 256 numbers per string byte. 
REM 64 handles upper case string and produces 10 digit num- 
ber 0..1073741823=6445-1 
REM 256 handles any string and produces 13 digit num- 
ber0. .1099511627776=256%5-1 
ans# = 0 
FOR i = 1 TO 5 
ans# = range * ans# + (ASC(MID$(str, i, 1)) + 32 * (range 
= 64)) MOD range 
NEXT i 
str2num# = ans# 
END FUNCTION 


With commutativity, whichever 
way round you work you get the orig- 
inal message back. For the mathe- 
matically inclined, decrypting an 
encrypted message M performs the 
calculation M “ (K * G) modulo N, 
and encrypting a decrypted message 
performs the calculation M “ (G * K) 
modulo N, which is the same thing. 
Because of the special way that kK, G 
and N were chosen, either calculation 
produces the original M, meaning the 
message is restored. It can be mathe- 
matically proven that this is the case, 
but here we will just take it on trust. 

To solve the signature problem, let’s 
say there are two parties, A and B. 
Each uses the above methods to gener- 
ate his own public and private keys 
for communications. With 150-digit 
primes the chance that two people 
will choose the same ones is effec- 
tively nil. Suppose B wants to send A 
the message ‘Buy 10,000 Gold Trust 
for me, ta very much, B’. If he used A’s 
public encryption no-one would know 
what the message was, but A couldn’t 
be confident that the message came 
from B or that B won’t welch on the 
deal later on. Anyone could have com- 
posed the message and sent it. 

Instead of immediately using A’s 
keys to encrypt, B uses his own private 
key to apply decryption. This doesn’t 
give anything away on B’s decryption 
key; it merely provides one sample of 
itin action. At this point anyone could 
find out the content of B’s message in 
this state by applying B’s encryption 
keys. These are public knowledge, so 
it is prudent for B to encrypt the mes- 
sage with A’s keys before sending it 
to A, who gets an A-encryption of a 
B-decryption of the message. 

To read the message, A must 
decrypt it with his private keys and 
apply encryption with B’s public keys. 
If the message is readable after this, B 
must have sent it because only B could 
have generated the B-decryption of 
the original text. It cannot be altered 
without knowing B’s decryption 
secrets, so it is as good as a signed 
document. There is one loophole, 
where A could forward the message 
to another party and it would arrive 
as if B had originally addressed it. B 
should directly address A in the mes- 
sage text: ‘Dear B, Buy 10,000...etc’ 


Fig 7: Sample output showing RSA encryption and decryption 


as commutativity, which solves the 
signature problem so that the method 
can also be used for financial author- 
ity messages and the like. 


Plain text: DEAR CONTROL, I COUNTED 37 SHIPS IN PORT TODAY 
- AGENT X : 

Encryption: *%&*!!ZST..etc.. 

Decryption: DEAR CONTROL, I COUNTED 37 SHIPS IN PORT ) TODAY 
- AGENT X 
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